By Karekin Johnson, Relationship Manager, Wells Fargo Government Banking
By now it’s no secret that the pandemic accelerated the adoption of new technologies and propelled us into an era marked by heightened digital interconnectivity. For local governments this has meant new payment channels, new ways of conducting business, and much more. The digital revolution, however, has also exposed weaknesses in local government controls and equipped fraudsters with new tools and resources to exploit those gaps.
With 71% of organizations being targets of payment fraud in 2021 it begets the question of how exactly did we get here? For local governments fraud has been a longstanding issue, but despite fraud attacks being on the rise, governments have been relatively slow to adopt protection. Fraudsters continue to innovate and adopt new tools. For local governments to protect themselves against this evolving threat, it’s important for public leaders to understand that no municipality is exempt from fraud, and fraud protection is a strategic imperative. Leaders must also understand that even though fraudsters are becoming increasingly sophisticated in their approach, the fraud tactics of today seek to exploit areas that have long been vulnerabilities intrinsic to the very nature of government. By examining fraud threats such as business email compromise (BEC) and ransomware we see how these attacks weaponize public information against local governments. We will also see how government leaders can mitigate their risk to these forms of fraud.
Currently the most prevalent fraud scam is business email compromise (BEC). According to the 2022 AFP Payments Fraud and Control Survey, 68% of organizations that experienced attempted or actual fraud in 2020 did so as a result of BEC. BEC remains one of the primary sources of payments fraud against organizations. In BEC attacks, fraudsters send phishing emails that impersonate a trusted source such as a vendor or executive to deceive employees into making payments. Some common forms of BEC use authentic invoices to impersonate a vendor or pose as a third party to request changes to payment information. BEC attacks typically target an organization’s accounts payable department, however every part of an organization is at risk. BEC can also target payroll, where for example, a school superintendent’s email is used to request fraudulent changes to payroll. Local governments are not exempt from BEC fraud. With easy access to government contracts, minutes, vendors, and contact information, fraudsters can utilize the transparency requirements of governments to exploit them. From 2018 through 2020, the FBI observed business email actors targeting state, local, tribal, and territorial municipal entities which resulted in losses ranging from $10,000 to $4 million in conjunction with considerable operational impairment. In 2020 a county government received an email that included new payment instructions which was determined to be a fraudulent request that resulted in a $1.6 million loss. Another example, which resulted in a $3.0 million loss, happened when a small city received an email request to change a payment method from a perceived contractor which was determined to be fraudulent. Fraudsters have the ability to leverage publically available information to impersonate a trusted source in order to deceive and defraud governments which makes detecting BEC attacks challenging.
The first step to mitigating the risk of BEC starts with education and training. To proactively protect against BEC attacks, local governments should adopt a fraud prevention strategy that includes:
State and local governments are visible targets of ransomware attacks. Ransomware is a malicious software or malware that breaks into a computer network and encrypts data to prevent access to it. This encryption disrupts the continuity of an organization’s operations. Fraudsters typically demand a ransom payment to restore access to confidential data. Ransomware typically originates from a user clicking on a phishing email or visiting an infected website. For local governments these malware carrying emails can look authentic and personalized depending on the amount of public information available for fraudsters to leverage. Ransomware is costly to local governments and results in significant disruptions to essential services. Comparitech estimated that in 2020, ransomware attacks against governments impacted over 17 million people and cost $18.9 billion. The K12 Security Information Exchange reported that ransomware attacks against schools has surpassed data breach attacks as the largest category of cyber-attacks. In 2020 in response to ransomware attacks, a Mid-Atlantic school district reported spending $9.7 million, a Midwestern school district reported being down for two days and a Southeastern City reported spending $3.0 million to rebuild their network. These are just a few examples that illustrate the financial and operational impact of ransomware attacks on local governments.
Governments must proactively mitigate their exposure to ransomware risk by adopting practices to include :
The digital revolution has unveiled a wealth of opportunity for local governments to serve their communities in new and efficient ways, however, it has also introduced a new frontier of risk and security. Whether the threat is BEC, ransomware, or other forms of fraud, leaders in local government must understand that since governments are intrinsically transparent fraudsters are likely to target their communities. Government leaders have a fiduciary responsibility which includes exercising prudence in the usage and safety of public funds. As the landscape continues to change governments will be faced with evolving threats. Therefore, it is necessary for leaders to develop and codify their security goals into a strategic plan and identify the right banking partner to stay abreast of latest trends in fraud.
Governments should consider the below questions when looking for an effective banking partnership:
These questions are essential to developing the right banking partnership when it comes to fraud. Established banks like Wells Fargo are committed to helping local governments mitigate their fraud risk and leveling the playing field by sharing key insights into the latest trends and fraud protection technologies.
For more information about fraud and security risks to governments and how to safeguard your community, please contact your Wells Fargo representative or fill out the contact us form.
Ibid. page 5
Ibid.
Wells Fargo Bank, N.A. Member FDIC.
PAR-0522-00155
LRC-0522
Sign On